>
> * fork my own user.eclass from v1.17, modify it to use --root $ROOT when calling shadow stuff

So first thing I'm running into is replacing getent with something that supports chrooting. Only immediate thought for users is using passwd --status. For groups I'm not even seeing anything obvious to use.
Any thoughts?